Update go.mod and go.sum (#29)

Go 1.26.0 carries 17 standard library vulnerabilities that govulncheck reports. The security workflow takes its toolchain from go.mod, so the scan failed. Go 1.26.8 clears them.

.github/workflows/security.yaml

@@ -31,6 +31,7 @@ jobs:
         uses: actions/setup-go@v5
         with:
           go-version-file: go.mod
+          check-latest: true
           cache: true
 
       - name: Install govulncheck

go.mod

@@ -1,10 +1,10 @@
 module github.com/lukaszraczylo/harness-sync
 
-go 1.26.0
+go 1.26.8
 
 require (
 	github.com/charmbracelet/huh v1.0.0
-	github.com/lukaszraczylo/oss-telemetry v0.2.3
+	github.com/lukaszraczylo/oss-telemetry v0.2.5
 	github.com/pelletier/go-toml/v2 v2.4.3
 	github.com/spf13/afero v1.15.0
 	github.com/spf13/cobra v1.10.2

go.sum

@@ -53,8 +53,8 @@ github.com/inconshreveable/mousetrap v1.1.0 h1:wN+x4NVGpMsO7ErUn/mUI3vEoE6Jt13X2
 github.com/inconshreveable/mousetrap v1.1.0/go.mod h1:vpF70FUmC8bwa3OWnCshd2FqLfsEA9PFc4w1p2J65bw=
 github.com/lucasb-eyer/go-colorful v1.4.1 h1:1EO+WB73+EH8EVbzlrG3KLAfEypQWVHIBqlTf+2hNss=
 github.com/lucasb-eyer/go-colorful v1.4.1/go.mod h1:R4dSotOR9KMtayYi1e77YzuveK+i7ruzyGqttikkLy0=
-github.com/lukaszraczylo/oss-telemetry v0.2.3 h1:xoDtBqeZGmXj7IteiE1M5WMuzeoqag58qEleI0Cf2Ms=
-github.com/lukaszraczylo/oss-telemetry v0.2.3/go.mod h1:+Cn78qZo8rc3T9eZt0v3oICYRdd75wORtSidc8lNjDQ=
+github.com/lukaszraczylo/oss-telemetry v0.2.5 h1:W6Qgwp7IY4yBRO361MmnEAmM59motdQpbAFAx8v6fJM=
+github.com/lukaszraczylo/oss-telemetry v0.2.5/go.mod h1:+Cn78qZo8rc3T9eZt0v3oICYRdd75wORtSidc8lNjDQ=
 github.com/mattn/go-isatty v0.0.24 h1:tGZZoVgT/KiqK1c8ocVLeDS8BSWMRd47J3Lbz7vsReI=
 github.com/mattn/go-isatty v0.0.24/go.mod h1:nMCL3Zebbrt45jsMDgnfIwz6ydEQApk5oEI3HqDio6A=
 github.com/mattn/go-localereader v0.0.1 h1:ygSAOl7ZXTx4RdPYinUpg6W99U8jWvWi9Ye2JC/oIi4=

internal/adapters/pi/pi.go

@@ -116,6 +116,17 @@ func piModelsJSON(b *canonical.Bundle) ([]byte, error) {
 		if m.Alias != "" {
 			entry["name"] = m.Alias
 		}
+		// Emit limits only when the profile sets them explicitly. Pi applies
+		// its own defaults (contextWindow 128000, maxTokens 16384) to a model
+		// definition that omits them, so writing ContextLimit()/OutputLimit()
+		// unconditionally would push canonical's defaults onto every model
+		// that never asked for them.
+		if m.Context > 0 {
+			entry["contextWindow"] = m.Context
+		}
+		if m.Output > 0 {
+			entry["maxTokens"] = m.Output
+		}
 		modelEntries = append(modelEntries, entry)
 	}
 	if len(modelEntries) == 0 && b.Profile.Gateway.DefaultModel != "" {

internal/adapters/pi/pi_test.go

@@ -56,6 +56,41 @@ func TestPiRender(t *testing.T) {
 	first := modelList[0].(map[string]any)
 	assert.Equal(t, "claude-sonnet-4-6", first["id"])
 	assert.Equal(t, "Sonnet", first["name"])
+	// A model with no explicit limits must carry none, so pi keeps applying
+	// its own defaults rather than inheriting canonical's.
+	assert.NotContains(t, first, "contextWindow")
+	assert.NotContains(t, first, "maxTokens")
+}
+
+func TestPiRenderEmitsExplicitModelLimits(t *testing.T) {
+	home := t.TempDir()
+	ad := New(WithHome(home))
+	b := &canonical.Bundle{
+		Profile: canonical.Profile{
+			Gateway: canonical.Gateway{URL: "https://gw", Token: "dummy"},
+			Models: []canonical.Model{
+				{ID: "local/current-model", Alias: "Local", Context: 1048576, Output: 32768},
+				{ID: "bare/model"},
+			},
+		},
+	}
+	fs, err := ad.Render(b)
+	require.NoError(t, err)
+
+	seen := map[string]adapter.File{}
+	fs.ForEach(func(f adapter.File) { seen[f.Dest] = f })
+
+	var models map[string]any
+	require.NoError(t, json.Unmarshal(seen[filepath.Join(home, ".pi", "agent", "models.json")].Content, &models))
+	list := models["providers"].(map[string]any)["hs-gw"].(map[string]any)["models"].([]any)
+
+	withLimits := list[0].(map[string]any)
+	assert.InDelta(t, float64(1048576), withLimits["contextWindow"], 0)
+	assert.InDelta(t, float64(32768), withLimits["maxTokens"], 0)
+
+	withoutLimits := list[1].(map[string]any)
+	assert.NotContains(t, withoutLimits, "contextWindow")
+	assert.NotContains(t, withoutLimits, "maxTokens")
 }
 
 func TestPiRenderMergesExistingSettings(t *testing.T) {